[16] Y. Chen and A. Machanavajjhala. On the privacy properties of variants on the sparse vector technique. arXiv preprint arXiv:1508.07306, 2015.
[17] Z. Ding, Y. Wang, G. Wang, D. Zhang, and D. Kifer. Detecting violations of differential privacy. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 475-489, 2018.
[18] K. Dixit, M. Jha, S. Raskhodnikova, and A. Thakurta. Testing Lipschitz Property over Product Distribution and its Applications to Statistical Data Privacy. In Theory of Cryptography Conference, pages 418-436. Springer, 2013.
[19] W. C. DMDave, Todd B. Acquire valued shoppers challenge, 2014. URL https://kaggle.com/competitions/acquire-valued-shoppers-challenge.
[20] R. M. Dudley. Uniform Central Limit Theorems, volume 142. Cambridge university press, 2014.
[21] C. Dwork and G. N. Rothblum. Concentrated Differential Privacy. arXiv preprint arXiv:1603.01887, 2016.
[22] C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating Noise to Sensitivity in Private Data Analysis. In Proc. of the Third Conf. on Theory of Cryptography (TCC), pages 265-284, 2006. URL http://dx.doi.org/10.1007/11681878_14.
[23] C. Dwork, A. Smith, T. Steinke, J. Ullman, and S. Vadhan. Robust Traceability from Trace Amounts. In 2015 IEEE 56th Annual Symposium on Foundations of Computer Science, pages 650-669. IEEE, 2015.
[24] M. Gaboardi, A. Haeberlen, J. Hsu, A. Narayan, and B. C. Pierce. Linear Dependent Types for Differential Privacy. In Proceedings of the 40th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pages 357-370, 2013.
[25] A. C. Gilbert and A. McMillan. Property Testing for Differential Privacy. In 2018 56th Annual Allerton Conference on Communication, Control, and Computing (Allerton), pages 249-258. IEEE, 2018.
[26] C. Guo, B. Karrer, K. Chaudhuri, and L. van der Maaten. Bounding Training Data Reconstruction in Private (Deep) Learning. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pages 8056-8071, 17-23 Jul 2022.
[27] Y. Han, J. Jiao, and T. Weissman. Minimax estimation of divergences between discrete distributions. IEEE Journal on Selected Areas in Information Theory, 1(3):814-823, 2020.
[28] A. Hannun, C. Guo, and L. van der Maaten. Measuring Data Leakage in Machine-Learning Models with Fisher Information. In UAI, pages 760-770, 2021.
[29] J. Hayes, S. Mahloujifar, and B. Balle. Bounding Training Data Reconstruction in DP-SGD, 2023.
[30] N. Homer, S. Szelinger, M. Redman, D. Duggan, W. Tembe, J. Muehling, J. V. Pearson, D. A. Stephan, S. F. Nelson, and D. W. Craig. Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays. *PLoS genetics*, 4(8):e1000167, 2008.
[31] S. L. Hyland and S. Tople. An Empirical Study on the Intrinsic Privacy of SGD. arXiv preprint arXiv:1912.02919, 2019.
[32] M. Jagielski, J. Ullman, and A. Oprea. Auditing differentially private machine learning: How private is private SGD? Advances in Neural Information Processing Systems, 33:22205-22216, 2020.
[33] B. Jayaraman and D. Evans. Evaluating Differentially Private Machine Learning in Practice. In USENIX Security Symposium, pages 1895–1912, 2019.